content-security-policy

Content Security Policy (CSP) header not implemented

contribute

Contribute.json isn't required on websites that don't belong to Mozilla

cookies

All cookies use the Secure flag and all session cookies use the HttpOnly flag

cross-origin-resource-sharing

Content is not visible via cross-origin resource sharing (CORS) files or headers

public-key-pinning

HTTP Public Key Pinning (HPKP) header not implemented

redirection

Initial redirection is to HTTPS on same host, final destination is HTTPS

referrer-policy

strict-transport-security

HTTP Strict Transport Security (HSTS) header not implemented

subresource-integrity

Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin

x-content-type-options

X-Content-Type-Options header not implemented

x-frame-options

X-Frame-Options (XFO) header not implemented

x-xss-protection

Diagnostics

Metrics

http

zeus-admin

DNS SaaS Service Detection

Allowed Options Method

Checks whether cookies in the HTTP response contain the HttpOnly attribute. If the HttpOnly flag is set, it means that the cookie is HTTP-only


HttpOnly Cookie - Detect

Generic CMS Detection using html meta generator tag

Metatag CMS Detection

This template searches for missing HTTP security headers. The impact of these missing headers can vary.


HTTP Missing Security Headers

File similar to robots.txt but intended to be read by humans wishing to contact a website’s owner about security issues. Often defines a security policy and contact details.

security.txt File

Multiple Apache Tomcat example scripts were detected.

Apache Tomcat Example Scripts - Detect

WAF Detection

Extract the issuer's organization from the target's certificate. Issuers are entities which sign and distribute certificates.


Detect SSL Certificate Issuer

Extract the Subject Alternative Name (SAN) from the target's certificate. SAN facilitates the usage of additional hostnames with the same certificate.


SSL DNS Names

Checks a sites certificate to see if there are wildcard CN or SAN entries.


Wildcard TLS Certificate

Both TLS 1.1 and SSLv3 are deprecated in favor of stronger encryption.


Deprecated TLS Detection (TLS 1.1 or SSLv3)

TLS version detection is a security process used to determine the version of the Transport Layer Security (TLS) protocol used by a computer or server.
It is important to detect the TLS version in order to ensure secure communication between two computers or servers.


TLS Version - Detect

A weak cipher is defined as an encryption/decryption algorithm that uses a key of insufficient length. Using an insufficient length for a key in an encryption/decryption algorithm opens up the possibility (or probability) that the encryption scheme could be broken.

Weak Cipher Suites Detection

JSESSIONID

K-Sup is an open-source CMS/portal solution dedicated to higher education and research created by Kosmos Education.

K-Sup

Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.

Java

Red Hat is an open-source Linux operating system.

Red Hat

MediaElement.js is a set of custom Flash plugins that mimic the HTML5 MediaElement API for browsers that don't support HTML5 or don't support the media codecs.

MediaElement.js

OpenSSL is a software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end.

OpenSSL

Mod_jk is an Apache module used to connect the Tomcat servlet container with web servers such as Apache, iPlanet, Sun ONE (formerly Netscape) and even IIS using the Apache JServ Protocol. A web server waits for client HTTP requests.

mod_jk

Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, Java Expression Language and WebSocket technologies.

Apache Tomcat

Apache is a free and open-source cross-platform web server software.

Apache HTTP Server

jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML.

jQuery UI

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jQuery

DataTables is a plug-in for the jQuery Javascript library adding advanced features like pagination, instant search, themes, and more to any HTML table.

DataTables

core-js is a modular standard library for JavaScript, with polyfills for cutting-edge ECMAScript features.

core-js

RSS is a family of web feed formats used to publish frequently updated works—such as blog entries, news headlines, audio, and video—in a standardized format.

Open Graph is a protocol that is used to integrate any web page into the social graph.

https://www.parisnanterre.fr/welcome-desk/